A company runs several microservices on an Amazon EKS cluster. Each microservice needs read access to one S3 prefix, and no service should inherit access that belongs to another. The team also wants no static keys stored anywhere in the cluster or the images. Which design meets these goals?
Show answer and explanation
Answer: C
IAM roles for service accounts link a Kubernetes service account to an IAM role through the cluster's OIDC provider. Pods receive a projected token, and the AWS SDK exchanges it for short-lived STS credentials. Each service account can have a least-privilege role of its own, so no static keys are stored in the cluster or in the image.
Why the other options are wrong
- A. Keys in a ConfigMap are readable by anyone with namespace access and are long-lived. They also share access across services, which breaks both requirements.
- B. Node-level roles are inherited by every pod on the node, so access cannot be scoped per microservice. That violates the least privilege requirement.
- D. Credentials baked into an image are static, persist in image layers, and are shared by every container built from that image. That is the anti-pattern the goal rules out.